Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Laravel Blade @yield and escaping

In Laravel 5 I have a master template containing:

<title>@yield('title') | Site Name</title>

And in my view I have:

@extends('master')

@section('title', $client->name)

...

The problem is, the @yield does not escape the data passed to it. So far, the only solution I've found is to manually escape the data like so:

@section('title', e($client->name))

Is this the best method? It means I have to manually escape data on every view that I use a variable. I don't see a way to escape the @yield directive from the master template - using {{ }} or e() around the @yield doesn't work.

like image 802
DisgruntledGoat Avatar asked Nov 24 '15 18:11

DisgruntledGoat


People also ask

How do you escape Laravel blade?

Actually Laravel supports {{}} and {{{}}} to escape data.

What is @yield used for in Laravel?

In Laravel, @yield is principally used to define a section in a layout and is constantly used to get content from a child page unto a master page.

What are the two primary benefits of Laravel blade?

Two of the primary benefits of using Blade are template inheritance and sections. We can define a blade page as a combination of layout and sections. Since most of the general web applications will have the same layout across the web pages.

Is Laravel blade fast?

All views in Laravel are usually built in the blade template. Blade engine is fast in rendering views because it caches the view until they are modified.


1 Answers

Why not do the following:

@section('title') {{$client->name}} @endsection

This is at least then consistent with escaping data in the rest of your views. The way you have it, you may be very likely to miss an e(). With the above, you will be able to see immediately when you render the view if you have not escaped.

UPDATE

What about using the raw PHP:

<title> <?php echo e($__env->yieldContent('title')); ?> | Site Name</title>

This is what the blade template engine replaces the @yield with, but I've add the escape helper.

This should mean you don't need to escape @section. I think this will work, haven't tried it.

like image 133
GWed Avatar answered Sep 22 '22 17:09

GWed